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NATIONAL FOREWORD 

This Indian Standard which is identical with ISO/TS 22003 : 2007 'Food safety management systems 
— Requirements for bodies providing audit and certification of food safety management systems' 
issued by the International Organization for Standardization (ISO) was adopted by the Bureau of 
Indian Standards on the recommendation of the Food Hygiene, Safety Management and Other 
Systems Sectional Committee and approval of the Food and Agriculture Division Council. 

The text of ISO Standard has been approved as suitable for publication as an Indian Standard without 
deviations. Certain conventions are, however, not identical to those used in Indian Standards. 
Attention is particularly drawn to the following: 

a) Wherever the words 'International Standard' appear referring to this standard, they should 
be read as 'Indian Standard'. 

b) Comma (,) has been used as a decimal marker, while in Indian Standards, the current 
practice is to use a point (.) as the decimal marker. 

In this adopted standard, reference appears to certain International Standards for which Indian 
Standards also exist. The corresponding Indian Standards which are to be substituted in their 
respective places are listed below along with their degree of equivalence for the editions indicated: 



International Standard 



ISO 1 9011 : 2002 Guidelines for quality 
and/or environmental management 
systems auditing 

ISO 22000 : 2005 Food safety 
management systems — Requirements 
for any organization in the food chain 



Corresponding Indian Standard 



IS/ISO 19011 : 2002 Guidelines for quality 
and/or environmental management 
systems auditing 

IS/ISO 22000 : 2005 Food safety 
management systems — Requirements for 
any organization in the food chain 



Degree of 
Equivalence 

Identical 



do 



The technical committee responsible for the preparation of this standard has reviewed the provisions 
of following International Standards referred in this adopted standard and has decided that they are 
acceptable for use in conjunction with this standard: 



International Standanj 
ISO/IEC 17000: 2004 



Title 
Conformity assessment — Vocabulary and general principles 



ISO/IEC 17021 ; 2006 Conformity assessment — Requirements for bodies providing audit and 

certification of management systems 
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introduction 

Certification of the food safety management system (FSMS) of an organization is one means of providing 
assurance that the organization has implemented a system for the management of food safety in line with its 
policy. 

Requirements for FSMSs can originate from a number of sources, and this Technical Specification has tjeen 
developed to assist in the certification of FSMSs that fulfil the requirements of ISO 22000. Food safety 
management systems — Requirements for any organization in tt)e food ctiain. The contents of this Technical 
Specification may also be used to support certification of FSMSs that are based on other sets of specified 
FSMS requirements. 

This Technical Specification is intended for use by bodies that carry out audit and certification of FSMSs. It 
gives generic requirements for such certification bodies performing audit and certification in the field of food 
safety management systems. Such bodies are referred to as certification bodies. This wording should not be 
an obstacle to the use of this Technical Specification by bodies with other designations that undertake 
activities covered by the scope of this document. Indeed, this Technical Specification should be usable by any 
body involved in the assessment of FSMSs. 

Certification activities involve the audit of an organization's FSMS. The form of attestation of conformity of an 
organization's FSMS to a specific FSMS standard (for example ISO 22000) or other specified requirements is 
normally a certification document or a certificate. 

It is for the organization being certified to develop its own management systems (including ISO 22000 FSMS. 
other sets of specified FSMS requirements, quality management systems, environmental management 
systems or occupational health and safety management systems) and, other than where relevant legislative 
requirements specify to the contrary, it is for the organization to decide how the various components of these 
will be arranged. The degree of integration between the various management system components will vary 
from organization to organization. It is therefore appropriate for certification bodies that operate in accordance 
with this Technical Specification to take into account the culture and practices of their clients with respect to 
the integration of their FSMSs within the wider organization. 
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Indian Standard 

FOOD SAFETY MANAGEMENT SYSTEMS — 

REQUIREMENTS FOR BODIES PROVIDING AUDIT 

AND CERTIFICATION OF FOOD SAFETY 

MANAGEMENT SYSTEMS 

1 Scope 

This Technical Specification 

— defines the rules applicable for the audit and certification of a feed safety management system (FSMS) 
complying with the requirements given in ISO 22000 (or other sets of specified FSMS requirements), and 

— provides the necessary information and confidence to customers about the way certification of their 
suppliers has been granted. 

Certification of FSMSs (named "certification" in this Technical Specification) is a third-party conformity 
assessment activity (see ISO/IEC 17000:2004, 5.5). Bodies performing this activity are therefore third-party 
conformity assessment bodies (named "certification body/bodies" in this Technical Specification). 

NOTE 1 Certification of an FSMS is sometimes also called "registration", and certification bodies are sometimes called 
"registrars". 

NOTE 2 A certification body can be non-govemmentat or governmental (with or without regulatory authority). 

NOTE 3 This Technical Specification is primarily intended to be used as a criteria document for the accreditation or 
peer assessment of certification bodies which seek to be recognized as being competent to certify that an FSMS complies 
with ISO 22000. It is also intended to be used as a criteria document by regulatory authorities and Industry consortia which 
engage in direct recognition of certification bodies to certify that an FSMS complies with ISO 22000. Some of its 
requirements could also be found useful by any other parties involved in the conformity assessment of such certification 
bodies, and in the conformity assessment of any bodies that undertake to certify the compliance of FSMSs with criteria 
additional to or other than those in ISO 22000. 

FSMS certification does not attest to the safety or fitness of the products of an organization within the food 
chain. However, ISO 22000 requires an organization to meet all applicable food-safety-related statutory and 
regulatory requirements through its management system. 

It is important to note that certification of an FSMS according to ISO 22000 is a management system 
certification and not a product certification. 

Other FSMS users can use the concepts and requirements of this Technical Specification provided that the 
requirements are adapted as necessary. 

2 Normative references 

The foltowing referenced documents are indispensable for the application of this document. For dated 
references, only the edition dted applies. For undated references, ttie latest edition of the referenced 
document (including any amendments) applies. 

ISO 1901 1 :2002, Guidelines for quality and/or environmental management systems auditing 

ISO 22000:2005, Food safety management systems — Requirements for any organization in the food chain 
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ISO/IEC 17000:2004, Conformity assessment — Vocabulary and general principles 

ISO/IEC 17021:2006, Conformity assessnyent — Requirements for bodies providing audit and certification of 
management systems 

3 Terms and definitions 

For the purposes of this document, the terms and definitions given in ISO/IEC 17000, ISO/IEC 17021, 
ISO 22000 and the following apply. 

NOTE In this Technical Specification, the tenns "product" and "service" are used separately, which is not in 
accordance with the definition of product given In ISO/IEC 17000. 

3.1 

hazard analysis and critical control point 

HACCP 

system which identifies, evaluates and controls hazards which are significant for food safety 

NOTE /Vlapted from Reference (8J. 

3.2 

food safety management system 

FSMS 

set of interrelated or interacting elements to establish policy and objectives and to achieve those objectives, 
used to direct and control an organization with regard to food safety 

NOTE See 3.2.1, 3.2.2 and 3.2.3 of ISO 9000:2005. 

4 Principles 

The principles given in Clause 4 of ISO/IEC 17021:2006 are the basis for the subsequent specific 
performance and descriptive requirements in this Technical Specification. This Technical Specification does 
not give specific requirements for all situations that can occur. These principles should be applied as guidance 
for the decisions that may need to be made for unanticipated situations. Principles are not requirements. 

The term 'management system" used in ISO/IEC 17021 shall be replaced by "food safety management 
system" in the context of this Technical Specification. 

5 General requirements 

5.1 General 

All the requirements given in Clause 5 of ISO/IEC 17021 :2006 apply. 

5.2 Management of impartiality 

The certification body and any part of the same legal entity shall not offer or provide hazard analysis 
consultancy, FSMS consultancy or management system consultancy. 

The fact that the organization employing the auditor is known to have provided hazard analysis consultancy, 
FSMS consultancy or management system consultancy on the management system, within two years 
foHowing the end of the consultancy, is likely to be conskiered as a high threat to impartiality. 
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The term "management system consultancy" mentioned in 5.2 of ISO/IEC 17021:2006 shall be replaced in the 
context of this Technical Specification by "hazard analysis consultancy, FSMS consultancy or management 
system consultancy". 



6 Structural requirements 

All the requirements given in Clause 6 of ISO/IEC 17021:2006 apply. 

7 Resource requirements 

7.1 Competence of management and personnel 

All the requirements given in 7.1 of ISO/IEC 17021:2006 apply. 

Additionally, the certification body shall have processes to ensure that personnel have appropriate knowledge 
relevant to the categories (see Annex A) in which it operates. 

7.2 Personnel involved in the certification activities 

7.2.1 General 

7.2.1.1 All the requirements given In 7.2 of ISO/IEC 17021:2006 apply. 

7.2.1.2 The certification body shall ensure that all personnel involved in the audit and certification 
activities possess the following personal attributes. The personnel shall be 

a) ethical (i.e. fair, truthful, sincere, honest and discreet), 

b) open-minded (i.e. willing to consider alternative ideas or points of view), 

c) diplomatic (i.e. tactful in dealing with people), 

d) observant (i.e. actively aware of physical surroundings and activities), 

e) perceptive (i.e. instinctively aware of and able to understand situations), 

f) versatile (i.e. adjust readily to different situations), 

g) tenacious (i.e. persistent, focused on achieving objectives), 

h) decisive (i.e. reach timely conclusions based on logical reasoning and analysis), and 
i) self-reliant (i.e. act and function independently while interacting effectively with others). 

7.2.2 Personnel carrying out contract review 

7.2.2.1 Education 

The certification body shall ensure that personnel carrying out contract review have the knowledge 
corresponding to a secondary education. 
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7.2.2.2 Food safety training 

The certification body shall ensure that personnel carrying out contract review have successfully completed 
training in 

a) hazard analysis and critical control point (HACCP) principles, hazard assessment and hazar-j analysis, 

b) food safety management principles including prerequisite programmes (PRPs), and 

c) relevant FSMS standards (e.g. ISO 22000). 

7.2.2.3 Audit training 

The certification body shall ensure that personnel carrying out contract review have successfully completed 
training in audit processes based on the guidance given in ISO 1901 1 . 

NOTE It Is not mandatory for personnel carrying out contract review to have or to maintain audit expsrience. 

7.2.2.4 Competences 

The certification body shall ensure that personnel carrying out contract review demonstrate the ability to apply 
knowledge and skills in the following areas: 

a) classification of applicants in food chain categories and sectors; 

b) assessment of applicant products, processes and practices; 

c) deptoyment of FSMS auditor competences and requirements; 

d) determination of audit time (see Annex B) and duration requirements; 

e) certification tx}d/s policies and procedures related to contract review. 
7.2.3 Personnel granting certification 

7.2.3.1 General 

The certificatkxi body shall ensure that the personnel who take the decision on granting certification have the 
same education, food safety training, audit training and work experience as required for an auditor in one 
category (see Annex A). 

NOTE It is not mandatory for personnel granting certificatk>n to have or to maintain audit experience. 

7.2.3.2 Competences 

The certification body shafl ensure that personnel granting certification demonstrate the ability to apply 
knowledge and skills in the foHowing areas: 

a) current prindptes of HACCP; 

b) understanding of PRPs; 

c) klentificatkxi of food safety hazards; 

d) implementation and management of food safety hazards, critical oontnt points (CCPs) and the ability to 
assess the effectiveness of selected control measures; 

e) corrections and corrective actions to be taken with regards to food safety matters; 
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f) assessment of potential food safety hazards linked to the food supply chain; 

g) laws and regulations relevant to food safety, In order to be able to conduct an effective audit of the FSMS; 
h) products, processes and practices; 

i) relevant food safety management system requirements; 

j) relevant standards; 

k) assessment and review of an audit report for accuracy and completeness; 

I) assessment and review of the effectiveness of corrective actions; 

m) the certification process. 

7.2.4 Auditors 

7.2.4.1 Education 

The certification body shall ensure that auditors have the knowledge corresponding to a post-sacondary 
education that includes general microbiology and general chemistry. 

The certification body shall also ensure that auditors have the knowledge corresponding to a post-secondary 
education that includes courses in the food chain industry category in which they conduct FSMS audits. 

EXAMPLES 

a) For the food Industry (Categories C, D, E, F, G and H in Table A.1): food microbiology, food processing fundamentals 
and food chemistry including food analysis. 

b) For farming (plants) (Category B in Table A.1 ): crop producbon. 

c) For farming (animals) (Categories A and F in Table A.1): animal production. 

d) For packaging/food machine/engineering industry (Categories I to M In Table A.1): science/engineering courses 
related to the discipline. 

7.2.4.2 Food safety training 

The certification body shall ensure that auditors have successfully completed training in 

a) t-IACCP principles, hazard assessment and hazard analysis, and 

b) food safety management principles including PRPs. 

The training course(s) should be recognized by the industry (and its stakeholders) as being appropriate and 
relevant. The approval or certifk:ation of the training courses by an independent body with the relevant 
expertise can provide some assurance that the course meets specified criteria. 

7.2.4.3 Audit training 

The certification body shall ensure that auditors have successfully completed training in 

a) audit technkiues based on ISO 1 9011 , and 

b) relevant FSMS standards (e.g. ISO 22000). 
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7.2.4.4 Wort( experience 

For a first qualification of an auditor in one or more categories, the certification body shall ensure that the 
auditor has a minimum of five years of full-time work experience in the food-chain-related industry, including at 
least two years of work in quality assurance or food safety functions within food production or manufacturing, 
retailing, inspection or enforcement, or the equivalent. 

The number of years of total work experience may be reduced by one year if the auditor has completed 
appropriate post-secondary education. 

7.2.4.5 Audit experience 

For a first qualification, the certification body shall ensure that within the last three years the auditor has 
performed at least twelve FSMS audit days in at least four organizations under the leadership of a qualified 
auditqf. 

NOTE FSMS audit days Include audit dayS dealing with ISO 9001 In the food industry or other FSMS audits. 

For extension to a new category, the certification body shall demonstrate that the auditor has the required 
competences through relevant education as required in 7.2.4.1, food-safety-related training in the new 
category, and either 

— six months of work experience in the new category, or 

— four FSMS audits under the supervision of a qualified auditor in the new category. 

For maintaining the qualification of the auditor, the certification body shall ensure that auditors have performed 
either 

— a minimum of five external audits per year, including at least two FSMS audits, or 

— a minimum of four FSMS on-site external audits or ten FSMS audit days per year. 

7.2.4.6 Competences 

7.2.4.6.1 The competences of auditors shall be recorded [see 5.5 c) of ISO 1901 1 :2002] for each category 
and sector (see Annex A). The certification body shall provide evkjence of a successful evaluation. 

7.2.4.6.2 The certification body shall ensure that auditors demonstrate the ability to apply knowledge and 
skills in the following areas. 

a) Audit principles, procedures and techniques: to enable the auditor to apply those appropriate to different 
audits and to ensure that audits are conducted in a consistent and systematic manner. An auditor shall be 
able 

— to apply audit prindptes, procedures and techniques, 

— to plan and organize the work effectively, 

— to conduct the audit within the agreed time schedule, 

— to prioritize and focus on matters of significance, 

— to collect infonmatJon through effective interviewing, listening, observing and reviewing documents, 
records and data, 

— to understand the appropriateness and consequences of using sanping technte^ues for auditing, 

— to verify the accuracy of OTltected infonnation, 
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— to confirm the sufficiency and appropriateness of audit evidence to support audit findings and 
conclusions, 

— to assess those factors that can affect the reliability of the audit findings and conclusions, 

— to use work documents to record audit activities, 

— to prepare audit reports, 

— to maintain the confidentiality and security of information, and 

— to communicate effectively, either through personal linguistic skills or through an interpreter. 

b) Management system and reference documents: to enable the auditor to comprehend the scope of the 
audit and apply audit criteria. Knowledge and skills In this area shall cover 

— the application of management systems to different organizations, 

— interaction between the components of the management system, 

— food safety management system standards, applicable procedures or other management system 
documents used as audit criteria, 

— recognizing differences between, and the priority of, the reference documents, 

— application of the reference documents to different audit situations, and 

— information systems and technology for authorization, security, distribution and control of documents, 
data and records. 

c) Organizational situations: to enable the auditor to comprehend the organization's operational context. 
Knowledge and skills in this area shall cover 

— organizational size, structure, functions and relationships, 

— general business processes and related terminology, and 

— cultural and social customs of the auditee. 

d) Applicable laws, regulations and other requirements relevant to the discipline: to enable the auditor to 
work within, and be aware of, the requirements that apply to the organization t»eing audited. Knowledge 
and skills in this area shall cover 

— local, regional and national codes, laws and regulations, 

— contracts and agreements, 

— international treaties and conventrons, and 

— other requirements to which the organizatk>n subscribes. 

7.2.4.6.3 The certificatton body shall ensure that auditors demonstrate the ability to apply terminotogy, 
knowledge and skills in the foltowing food safety specific areas: 

a) current principles of HACCP; 

b) relevant PRPs for the considered category(ies) (see Annex A); 

c) identifkatron of food safety hazards; 

d) mettrodotogies used for determination, implementation and management of control me^ures (PRPs, 
operational PRPs and CCPs) and the ability to assess the effectiveness of selected control measures; 
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e) corrections and corrective actions to be taken with regards to food safety matters; 

f) assessment of potential food safety tiazards linked to the food supply chain; 

g) evaluation of the relevance of the applicable PRPs, including establishing or selecting an appropriate 
evaluation method or guide for these PRPs for the category(ies) considered (see Annex A); 

h) laws and regulations relevant to food safety in order to be able to conduct an effective audit of the FSMS; 

i) products, processes and practices of the specific sector(s) (see Annex A); 

j) relevant food safety management system requirements; 

k) relevant food safety standards. 

7.2.5 Technical experts 

7.2.5.1 Education 

The certification tiody shall ensure that technical experts have the knowledge corresponding to a post- 
secondary education in the food chain industry sector being audited, in the processes being audited or in the 
food safety hazards applicable to the sector. 

7.2.5.2 Work experience 

The certification body shall ensure that technical experts have work experience in their technnal area. 

7.2.5.3 Competences 

The certification body shall ensure that technical experts demonstrate the ability to provide expertise in their 
technk:al area. 

7.2.6 Selection of ttie audit team 

The certificatran body shall ensure that the FSMS audit team have competences in ttie application of PRPs 
and HACCP in the specific sector required by the audit (see Annex A). 

7.3 Use of individuai external audKors and external technical experts 

All the requirements given in 7.3 of ISO/lEC 17021:2006 apply. 

7.4 Personnel records 

All the requirements given in 7.4 of ISO/lEC 17021:2006 apply. 

7.5 Outsourcing 

All the requirements given in 7.5 of ISO/IEC 17021:2006 apply. 

8 Information requirements 

All the requirements given in Clause 8 of ISO/IEC 17021:2006 apply. 

The certification documents shall identify in detail what activity is certified, referring to sectors (see Anrwx A). 
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9 Process requirements 

9.1 General requirements 

9.1.1 The certification body shall precisely define the scope of certification in tenns of levels of the food 
chain (e.g. primary production, food processing, packaging material production), category(ies) and sectors 
according to Annex A. The certification body shall not exclude part of the processes, sectors, products or 
services from the scope of certification when those processes, sectors, products or services have an influence 
on the food safety of the end products. 

9.1.2 The certification body shall have a process for choosing the audit day, time and season so that the 
audit team has the opportunity of auditing the organization operating on a representative number of product 
lines, categories and sectors covered by the scope. 

9.1.3 All the requirements given in 9.1.1 to 9.1.3 of ISO/IEC 17021:2006 apply. 

9.1.4 The certification body shall have documented procedures for determining audit time, and for each 
client the certification body shall determine the time needed to plan and accomplish a complete and effective 
audit of the client's FSMS. The audit time determined by the certification body, and the justification for the 
determination, shall be recorded. In determining the audit time, the certification body should consider Annex B 
and shall consider, among other things, the following aspects: 

a) requirements of the relevant FSMS standard; 

b) size and complexity of the organization; 

c) technological and regulatory context; 

d) any outsourcing of any activities included in the scope of the FSMS; 

e) results of any prior audits; 

f) number of sites and multi-site considerations. 

9.1.5 For multi-site organizations, the requirements given in 9.1 .5.1 and 9.5.1 .3 apply. 

9.1.5.1 Where the certification body is certifying a multi-site organization under one certificate, the 
following conditions apply: 

a) all sites are of the same activity and are located within the same country; 

b) all sites are operating under one centrally controlled and administered FSMS as defined in Clause 4 of 
ISO 22000:2005, or equivalent for other FSMSs; 

c) an internal audit has been conducted on each site within the three years prior to certification; 

d) following certification, an internal audit shall be carried out on each site within the certification period; 

e) the internal audits of all sites shall comply with ISO 22000 or equivalent; 

f) audit findings of the individual sites shaN be considered indicative of the entire system and correction shaH 
be implemented accordingly. 

9.1.5.2 The use of multi-site sampling is only possible for organizations with more than 20 sites and only 
for categories A, B, G, H artd J (see Table A.1). This applies both to ttie initial certificatk>n and to survefflwice 
audtts. 
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9.1.5.3 Where the certification body offers multi-site certification, the certification body shall utilize a 
sampling programme to ensure an effective audit of the FSMS where 

a) the sampling for more than 20 sites shall be at the ratio of 1 site per 5 sites with a minimum of 20. All sites 
shall be randomly selected and, after the audit, no sampled sites may be nonconforming (i.e. not meeting 
certification thresholds for ISO 22000), 

b) evaluation of the audit findings of the sampled sites shall be deemed equivalent to the intemal audit 
findings of the same sites of the organization, 

c) at least annually, an audit of the central FSMS shall be perfonned, 

d) at least annually, surveillance audits shall be performed on the sampled sites, and 

e) audit findings of the sampled sites shall be considered indicative of the entire system and correction shall 
be implemented accordingly. 

Table 1 gives examples of the number of sites to audit when sampling is used. 

Table 1 — Examples of the number of sites to be audited wtien multi-site sampling is used 





Total number of sites | 


jc between 
1 and 20 


21 


22 


23 


24 


25 


26 


27 


28 


Number of sites at)Ove 20 





1 


2 


3 


4 


5 


6 


7 


8 


Additional number of sites to audit 





1 


1 


1 


1 


1 


2 


2 


2 


Number of sites to be audited 


X 


21 


21 


21 


21 


21 


22 


22 


22 



9.1.6 All the requirements given in 9.1 .6 to 9.1 .9 of ISO/IEC 17021 :2006 apply. 

9.1.7 The certification body shall provide a written report for each audit. The report shall be based on 
relevant guidance provided in ISO 1901 1 . The audit team may identify opportunities for improvement but shall 
not recommend specific solutions. Ownership of ttie audit report shall be maintained by the certification tx}dy. 

The report shall include references to PRPs used by the organization, HACCP methodology used, comments 
on the HACCP team, and other issues relevant to the FSMS. 

9.1.8 All the requirements given in 9.1.11 to 9.1.15 of ISO/IEC 17021:2006 apply. 
9.2 Initial audit and certification 

9.2.1 Application 

All the requirements given in 9.2.1 of ISO/IEC 17021 :2006 apply. 

The certification body shall require the applicant organization to provide detailed infonnation concerning 
process lines, HACCP studies and the number of shifts. 

9.2.2 Application review 

All the requirements given in 9.2.2 of ISO/IEC 17021:2006 apply. 
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9.2.3 Initial certification audit 

The initial certification audit of an FSMS shall be conducted in two stages: stage 1 and stage 2. 
9.2.3.1 Stage 1 audits 

9.2.3.1.1 All the requirements given in 9.2.3.1.1 of ISO/IEC 17021:2006 apply. 

Where an organization has implemented an externally developed combination of control measures, the 
stage 1 audit shall review the documentation included in the FSMS to determine if the combination of control 
measures is suitable for the organization, was developed in compliance with the requirements of ISO 22000, 
and is kept up to date. 

The availability of relevant authorizations should be checked when collecting the information regarding the 
compliance to regulatory aspects. 

9.2.3.1.2 The objectives of the stage 1 audit are to provide a focus for planning the stage 2 audit by gaining 
an understanding of the FSMS in the context of the organization's food safety hazard identificatk>n, analysis, 
HACCP plan and PRPs, policy and objectives, and, in particular, the organization's state of preparedness for 
audit by reviewing the extent to which 

a) the organization has identified PRPs that are appropriate to the business (e.g. regulatory and statutory 
requirements), 

b) the FSMS includes adequate processes and methods for the identification and assessment of the 
organization's food safety hazards, and subsequent selection and categorization of control measures 
(combinations), 

c) food safety legislation is in place for the relevant sector(s) of the organization, 

d) the FSMS is designed to achieve the organization's food safety policy, 

e) the FSMS implementation programme justifies proceeding to the audit (stage 2), 

f) the validation, verifteatton and improvement programmes conform to the requirements of the FSMS 
standard, 

g) the FSMS documents and arrangements are in place to communicate intemally and with relevant 
suppliers, customers and interested parties, and 

h) additional documentation needs to be reviewed and/or what knowledge needs to be obtained in advance. 

9.2.3.1.3 For FSMS, the stage 1 audit shall be carried out at the client's premises in order to achieve the 
objectives stated above. 

9.2.3.1.4 All ttie requirements given in 9.2.3.1.2 of ISO/IEC 17021:2006 apply. 

The dient shall be infbnned that the results of the stage 1 audit may lead to postponement or canceHatmn of 
the stage 2 audit. 

9.2.3.1.5 Any part of the FSMS that is audited during the stage 1 audit and determined to be fuNy 
implemented, effective and in conformity with requirements, may not need to be re-audHed during the stage 2 
audit. However, the certifkaAion body shall ensure that the already audited parts of the FSMS continue to 
conform to the certification requirements. In this case, the stage 2 audit report shall indude these fwxiings and 
shall dearly state that conformity hse been established during the stage 1 audit. 

9.2.3.1.6 AH the reqwements given in 9.2.3.1 .3 of ISO/IEC 17021 :2006 apply. 

The interval between stage 1 and stage 2 audits is reasonably expected to be not k>nger than 6 months. The 
stage 1 aucfit should be repeated if a kxiger interval is needed. 
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9.2.3.2 Stage 2 audit 

All the requirements given in 9.2.3.2 of ISO/IEC 17021:2006 apply. 

9.2.4 Initial certification audit conclusions 

All the requirements given in 9.2.4 of ISO/IEC 17021:2006 apply. 

9.2.5 Information for granting initial certification 

All the requirements given in 9.2.5 of ISO/IEC 17021:2006 apply. 

9.3 Surveillance activities 

All the requirements given in 9.3 of ISO/IEC 17021:2006 apply. 

9.4 Recertification 

All the requirements given in 9.4 of ISO/IEC 17021:2006 apply. 

9.5 Special audits 

All the requirements given in 9.5 of ISO/IEC 17021:2006 apply. 

9.6 Suspending, withdrawing or reducing the scope of certification 

All the requirements given in 9.6 of ISO/IEC 17021:2006 apply. 

9.7 Appeals 

All the requirements given in 9.7 of ISO/IEC 17021:2006 apply. 

9.8 Complaints 

All the requirements given in 9.8 of ISO/IEC 17021:2006 apply. 

9.9 Records of applicants and clients 

All the requirements given in 9.9 of ISO/IEC 17021:2006 apply. 

10 Managennent system requirements for certification bodies 

All the requirements given in Clause 10 of ISO/IEC 17021:2006 apply. 
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Annex A 

(normative) 

Classification of food chain categories 



The certification body shall use Table A.1 

a) to define the scope that it undertakes, 

b) to identify if any technical qualification of its auditors is necessary for that particular category or sector, 
and 

c) to select a suitably qualified audit team. 

The examples given in Table A.1 are not exhaustive but are only an indication of relevant topics. 
The scope of one specific client organization may cover more than one category. 

Table A.1 — Food chain categories 



Category codes 


Categories 


Examples of sectors 


A 


Farming 1 (Animals) 


animals: fish; egg production: milk production: 
beekeeping: fishing: hunting; trapping 


B 


Famiing 2 (Plants) 


fruits: vegetables: grain; spices: horticultural 
products 


C 


Processing 1 

(Perishable animal products) 

Including all activities after fanning, e.g. 

slaughtering 


meat, poultry, eggs, dairy and fish products 


D 


Processing 2 

(Perishable vegetal products) 


fresh fruits and fresh juices; preserved fruits; 
fresh vegetables; preserved vegetables 


E 


Processing 3 

(Products with long shelf life at ambient 

temperature) 


canned products: biscuits: snacks; oH: drinking 
water; beverages; pasta: ftour; sugar; salt 


F 


Feed production 


animal fised; fish feed 


G 


Catering 


hotels; restaurants 


H 


Distributran 


retail outlets: shops: wholesalers 


1 


Servtees 


water supply: cleaning; sewage: waste disposal: 
devek>pment of product, process and 
equipment; veterinary services 


J 


Transport and storage 


transport and storage 


K 


Equipment manufacturing 


process equipment; vending machmes 


L 


(Bk>)chemteal manu^K^ring 


additives: vitamins: pestkxles: drugs: fierttiizers: 
cleaning agents: tNocultures 


M Packaging material manufacturing 


packaging material 



m 



IS/iSO/rS 22003 : 2007 



Annex B 

(informative) 

Minimum audit time 



B.1 General 

In determining the audit time needed for each site, as required in 9.1.4, the certification body should consider 
the minimum on-site duration for initial certification given in Table B.1. 

The minimum time includes stage 1 and stage 2 of the initial certification audit (see 9.2.3) but does not include 
the time for preparation of the audit nor for writing the audit report . 

The minimum audit time is established for the audit of an FSMS which includes only one HACCP study. A 
HACCP study corresponds to a hazard analysis for a femily of products/services with similar hazards and 
similar production technology and, where relevant, similar storage technology. 

The minimum surveillance audit time should be one-third of the initial certification audit time, with a minimivn 
of 0,5 audit days. The minimum renewal time should be two-thirds of the initial certification audit time, with a 
minimum of 0,5 audit days. 

Where there is no relevant certified management system in place, additional time should be added for the 
audit. To be considered relevant, a management system certificate should cover the scope of food safety for 
the relevant product/service. 

The number of employees should be expressed as the number of full-time equivalent employees (FTEs). 

Certain categories are subject to mutihsite sampluig (see 9.1.5.2) and this may be taken into account when 
calculating the audit time. 

Other factors may necessitate increasing the minimum audit time (e.g. number of product types, number of 
product lines, product development, number of CCPs, number of operational PRPs, building area, 
infrastructure, in-house laboratory testing, need fw a ta^n^ator). 

B.2 Calculation of ininimunni initial certification audit tbne 

B^l Minimum audit time for single site. Ts: 

Ts = (D + H + MS + FTE) 
wtiere 

D is the basis on-site audit time: 

H is the audit days for additional HACCP studies; 

MS is the audit days for absence of relevant management system; 

FTE is the audit days per numt>er of employees. 
B.2.2 Minimwn audit time for each additional site, Tm: 

Tm = Tsx 50/100 
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Table B.1 — Minimum initial certification audit time 



Category 

(see 
Annex A) 


D 

Basic 
on-site audit time 

(in audit days) 


H 

For each additional 
HACCP study 

(in audit days) 


MS 

Absence of 

certified relevant 

management 

system 

(in audit days) 


FTE 
Number of employees 

(in audit days) 


For each 

additional site 

visited 


A 


0,75 


0,25 


0.25 


1 to 19 = 

20 to 49 = 0,5 

50 to 79= 1,0 

80to199=1,5 

200 to 499 = 2,0 

500 to 899 = 2,5 

900 to 1 299 = 3,0 

1 300 to 1 699 = 3,5 

1700 to 2 999 = 4,0 

3 000 to 5 000 = 4.5 

> 5 000 = 5,0 


50 % of minimum 
on-site audit t»ne 


B 


0,75 


0,25 


C 


1,50 


0,50 


D 


1,00 


0,50 


E 


1,50 


0,50 


F 


1,50 


0,50 


G 


1,00 


0.50 


H 


1,00 


0,50 


1 


1.00 


0,25 


J 


1,00 


0.25 


K 


1,00 


0.25 


L 


1,50 


0,50 


M 


1,00 


0.25 
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